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The number of steps any classical computer requires in order to find the prime 
factors of an Z-digit integer N increases exponentially with l, at least using algo- 
rithms M known at present. Factoring large integers is therefore conjectured to be 
intractable classically, an observation underlying the security of widely used crypto- 
graphic codes [jï], ^j. Quantum computers [||], however, could factor integers in only 
polynomial time, using Shor's quantum factoring algorithm [EL ra, |6). Although im- 
portant for the study of quantum computers 0, experimental demonstration of this 
algorithm has proved elusive [^], |Ï0f| . Here we report an implementation of the 
simplest instance of Shor's algorithm: factorization of N=15 (whose prime factors are 



3 and 5). We use seven spin-1/2 nuclei in a molecule as quantum bits [11, which 
can be manipulated with room temperature liquid state nuclear magnètic resonance 
techniques. This method of using nuclei to store quantum information is in principle 



scalable to many quantum bit systems |13|| , but such scalability is not implied by the 
present work. The significance of our work lies in the demonstration of experimen- 
tal and theoretical techniques for precise control and modelling of complex quantum 
computers. In particular, we present a simple, parameter-free but predictive model 
of decoherence effects [fï"4[l in our system. 

Shor's factoring algorithm works by utilizing a quantum computer to quickly determine the 
period of the function f(x) = a x mod N (the remainder of a x divided by N), where a is a randomly 
chosen small number with no factors in common with N; from this period, number-theoretic 
techniques can be employed to factor N with high probability [Q] . The two main components of the 
algorithm, modular exponentiation (computation of a x mod N) and the inverse quantum Fourier 
transform (QFT) take only 0(l 3 ) operations [f|, ||, g. Classically, in contrast, prime factorization 
takes C(2 íl/3 ) operations Q, which quickly becomes intractable as l increases. 

The simplest meaningful instance of Shor's algorithm is factorization of N = 15 [Q] — the algo- 
rithm fails for N even or a prime power. Even for such a small N, quantum factorization poses at 
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present a significant experimental challenge: it requires coherent control over seven quantum bits 
(qubits) in the course of a long sequence of controlled interactions, even after maximal reduction 
of the quantum circuit; including the state initialization, interactions between almost all pairs of 
qubits are needed. In comparison with earlier work |8|, |Ï0[] , this experiment thus puts extraordi- 
narily high demands on the spin-spin coupling network, the degree of control over the Hamiltonian 
and the spin coherence times. Furthermore, numerically predicting the outcome of these experi- 
ments has been considered impractical due to the enormous size of the state space transformations, 
which are described by ~ 4 7 x 4 7 real parameters if decoherence effects are included. 

Implementation of the algorithm can be broken into four distinct steps (Fig. ||a), with 
the most complex being the computation of f(x) = a x modN for 2 n vàlues of x in paral- 
lel. Following Standard classical circuit techniques, this is performed by utilizing the identity 
a x = a 2 " a5n-1 . . . a 2xi a x °, where are the binary digits of x. Modular exponentiation thus con- 
sists of serial multiplication by a mod N for all k (0 < k < n — 1) for which \xk) = The powers 

nfc 

a can be efficiently pre-computed on a classical machine by repeated squaring of a. For N = 15, 
a may be 2, 4, 7, 8, 11, 13 or 14. If we happen to pick a = 2, 7, 8 or 13, we find that a mod 15 = 1, 
and therefore all a 2 * mod N = 1 for k > 2. In this case, f(x) simplifies to multiplications controlled 
by just two bits, xq and x\. If a = 4, 11 or 14, then a 2 mod 15 = 1, so only xq is relevant. Thus, 
the first register can be as small as two qubits (n = 2); however, three qubits (n = 3) allow for 
the possibility of detecting more periods and thus constitutes a more stringent test of the modular 
exponentiation and QFT |Ï5| . Together with the m = [log 2 15] = 4 qubits to hold f(x), we need 
seven qubits in total (Fig. ||b). We implemented this algorithm and tested it on two representative 
parameter choices: o = 11 (an "easy" case) and o = 7 (a "difficult" case). 

The custom-synthesized molecule used as the quantum computer for this experiment contains 
five 19 F and two 13 C spin-1/2 nuclei as qubits (Fig. |2|). In a static magnètic field, each spin has 
two discrete energy eigenstates, |0) (spin-up) and |1) (spin-down), described by the Hamiltonian 
7Íq = —J2í? lu; íIzí, where loí/2tï is the transition frequency between |0) and |1) and I z is the z 
component of the spin angular momentum operator. All seven spins in this molecule are remarkably 
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well separated in frequency u>í/2tt, and interact pairwise via the J-coupling, described by Tíj = 
52 i<j 2TrhJijI zi I zj 0. 

The desired initial state of the seven qubits is = |0000001) (Fig. []]). However, experimen- 
tally we start from thermal equilibrium. The density matrix is then given by pth = e~^°/ kBT /2 7 , 
with ksT 3> hu>i at room temperature so each spin is in a statistical mixture of |0) and |1) (Fig. Ha). 



We converted p t h into a 7-spin effective pure state |ll|, |l2j p\ via temporal averaging |9J (step 0); p\ 
constitutes a suitable initial state for Shor's factoring algorithm since it generates the same signal 



as (V'l)) up to a proportionality constant [11, 12 1. While p\ is highly mixed and in fact remains 
separable under unitary transforms, the observed dynamics under múltiple qubit operations such 



as in Shor's algorithm apparently remain hard to simulate classically ][18| , 19, pÜ| . 

The quantum circuit of Fig. || was realized with a sequence of ~ 300 (a = 7) spin-selective 
radio-frequency (RF) pulses separated by time intervals of free evolution under the Hamiltonian 
(Fig. |3|). The pulse sequence is designed such that the resulting transformations of the spin states 
correspond to the computational steps in the algorithm. Upon completion of this sequence, we 
estimate the state of the first three qubits, p ~ ^c u, c|c2 3 /r)(c2 3 /r|, via nuclear magnètic resonance 
(NMR) spectroscopy. In the experiment, an ensemble of independent quantum computers rather 
than a single quantum computer was used, so the measurement gives the bitwise average value of 
8c/ r, instead of a sample of 8c/ r. This is sufficient to determine r in the present experiment, but for 



larger N a continued fractions algorithm will need to be performed on the quantum computer [11] 
requiring additional qubits. From r, at least one factor of N is given by the greatest common 
denominator (gcd) of a r / 2 ± 1 and N (with probability greater than 1/2); the gcd can be computed 
efficiently using Euclid's algorithm on a classical computer Q . 

The experimental spectra acquired upon completion of the easy case (a = 11) of Shor's algorithm 
(Fig. 0c) clearly indicate that qubits 1 and 2 are in |0) (spectral lines up), and that 3 is in an equal 
mixture of |0) and |1) (lines up and down, and the integral of the spectrum equal to zero). With 
qubit 3 the most significant qubit after the inverse QFT p2| , the first register is thus in a mixture 
of 1 000) and 1 100) , or |0) and |4) in decimal notation. The periodicity in the amplitude of \y) 



is thus 4, so r = 2 n /4 = 2 and we find that gcd(ll 2 / 2 db 1,15) = 3,5. The prime factors thus 
unambiguously derive from the output spectra. 

From analogous spectra for the dinicult case (a = 7; Fig. |]d) , we see that qubit 1 is in 1 0) , and 
qubits 2 and 3 are in a mixture of |0) and |1). The register is thus in a mixture of |000), 1 010) , 1 100) 
and 1 110) , or |0), |2), |4) and |6). The periodicity in the amplitude of \y) is now 2, so r = 8/2 = 4 
and gcd(7 4 / 2 ± 1, 15) = 3, 5. Thus, even after the long and complex pulse sequence of the dinicult 
case, the experimental data conclusively indicate the successful execution of Shor's algorithm to 
factor 15. 

Nevertheless, there are obvious discrepàncies between the measured and ideal spectra, most no- 
tably for the dinicult case. Using a numerical model, we have investigated whether these deviations 
could be caused by decoherence. A full description of relaxation for the seven coupled spins involves 
almost 4 7 x 4 7 degrees of freedom and requires knowledge of physical properties of the molecule 
which are not available 24]. In order to get a first estimate of the impact of decoherence 
during the factoring pulse sequence we assume that each spin experiences independent stochastic 
relaxation with correlation time scales <C 1/ljí. This permits the use of the phenomenological 
Bloch equations pq| , with just two time constants per spin (Ti and T2). We implemented this de- 
coherence model for seven coupled spins via the operator sum representation |26| p t—y J2 k E k pE k 
(Sfc-S'l-^'fe = I)i starting from existing single spin models [27] of generalized amplitude damping 
(GAD, Tx), 
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with 7 = 1 — e Í//Tl , p = 1/2 + Tiuj/AkBT and À ~ (1 + e í//T2 )/2. The following observations 



simplify the extension of these separate single spin descriptions to an integrated model for seven 
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spins: (1) GAD (and PD) error operators acting on different spins commute; (2) the for GAD 
commute with the Ek for PD when applied to arbitrary p; and (3) PD commutes with the ideal 
unitary time evolution e"*^* {TL = TÍq + TLj). However, GAD does not commute with e~ lWí , and 
PD and GAD do not commute with the ideal unitary evolution during RF pulses. Nevertheless, 
we have treated these as commuting transformations, such that all of the processes which occur 
simultaneously can be modeled sequentially. 

Specifically, the model simulates a delay time of duration td by e~ l ' Htd followed by GAD acting 
on spin 1 for a duration td, then GAD acting on spin 2 and so forth, followed by PD acting serially 
on each spin. Similarly, a shaped pulse of duration t p was modeled by a delay time of duration 
t p (e _íW ° íp , GAD and PD) followed by an instantaneous pulse. Using this simple model, the 7- 
spin simulation of the complete Shor pulse sequence, including 36 temporal averaging sequences, 
required only a few minutes on an IBM quad power3-II processor machine. Measured vàlues of 
T\ and Ti (Fig. |2|) were used in the model. 

The output spectra predicted by this parameter-free decoherence model are also shown in 
Figs. and d. While some discrepàncies between the data and the simulations remain (due 
to the approximations in the model as well as due to experimental imperfections such as RF inho- 
mogeneity, imperfect calibrations, incomplete field drift compensation and incomplete unwinding 
of coupled evolution during the RF pulses ) , the model agrees well with the large non-idealities 
of the data. The predictive value of the model was further confirmed via independent test experi- 
ments. 

This is the first NMR quantum computation experiment for which decoherence is the dominant 
source of errors ||; the demands of Shor's algorithm clearly push the limits of the current molecule, 
despite its exceptional properties. At the same time, the good agreement between the measured 
and simulated spectra suggests that the degree of unitary control in the experiment was very high, 
which bodes well for related proposed implementations of quantum comp úters [28, |29|. Finally, our 
parameter-free decoherence model, a predictive tool for modeling quantum errors in this complex 
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system, provides an avenue for future design simulation of quantum computers. 
Methods 

Experiments were performed at the IBM Almadén Research Center with an 11.7 T (500 MHz) 
Oxford Instruments magnet, a custom-modified four-channel Varian Unity INOVA spectrometer, 
and a Nalorac HFX probe. We extended the techniques of Ref. |J for serving múltiple nuclei per 
channel, for reducing cross-talk between RF pulses on different spins and for sending simultaneous 



pulses. We used spin-selective Hermite-180 and Gaussian-90 pulses [17], shaped in 256 steps, with 
a duration of 0.22 to ~ 2 ms. A technique to compensate for coupling effects during the selective 
pulses was developed and implemented via "negative delay" times before and after the pulse. 
The amount of negative evolution needed depends on the pulse shape and was pre-computed via 
numerical simulations. 

To create an effective pure ground state of all seven spins, which has never been done before, 
we used a two-stage extension of the scheme of Ref. Q, necessary because ojisç is very different 
from u>i9 p. The five 19 F spins are made effective pure via the summation of nine experiments, each 
with a different sequence of CJVy and Ni gates (CNj stands for a controlled-NOT operation, which 
flips the target qubit j if and only if the control i is in |1); N simply flips i) ||27|| . These nine 
experiments are executed four times, each time with different additional CNj and Ni, such that 
the two 13 C spins are also made effective pure. Summation of the 4 x 9 = 36 experiments along 
with a not on spin 7 gives p\. The state preparation sequences were designed to be as short as 
possible (~ 200 ms) by making optimal use of the available coupling network jü| . 

Multiplication of y = 1 by amodl5 controlled by xq (qubit 3) was replaced by controlled- 
addition of (a — 1) mod 15. For a = 11, this is done by CN^CN^ç, and for a = 7 by CN35CN3Q 
(gates A and B of Fig. Qb). Multiplication of y by 7 2 mod 15 is equivalent to multiplication of 
y by 4 mod 15, which reduces to swapping y$ with yi and y\ with 7/3. Both SWAP operations 
must be controlled by x\, which can be achieved Q] via gates C,D,E and F,G,H of Fig. |ï|b. 
This quantum circuit can be further simplified by a quantum analogue to peephole compiler opti- 
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mization ]3Ï| , which should become Standard in future quantum compilers: (1) the control qubit 
of gate C is |0), so C was suppressed; (2) similar ly, F was replaced by ÍV5; (3) gates H and E 
are inconsequential for the final state of the first register, so they were omitted; (4) the targets 
of the doubly controlled not gates D and G are in a basis state, so they can be implemented as 
CY^C ZQ4CY24 and CY^C Z^CY^i (CZij stands for a 90° z rotation of j if and only if i is in 
|1)); (5) the refocusing schemes were kept as simple as possible. To this end, A was carried out 
after E. We did refocus inhomogeneous dephasing for all spins in the transverse plane. Residual 
couplings with the cyclopentadienyl protons were decoupled by continuous on-resonance low power 
irradiation using a separate power amplifier and additional power combiners and RF filters. After 
all these simplifications, the pulse sequence for 7 X mod 15 was ~ 400 ms long. The inverse QFT 
was implemented as shown in Fig. |]b and took ~ 120 ms. The duration of the complete sequence 
for the Shor algorithm was thus up to ~ 720 ms. A detailed report on these methods will be 
published elsewhere [jíq| . 
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FIG. la. Outline of the quantum circuit for Shor's algorithm. Wires represent qu bits and boxes 
represent operations. Time goes from left to right. (0) Initialize a first register of n = 2|~log 2 N~\ 
qubits to |0) ® . . . <g> |0) (for short |0)) and a second register of m = |~log 2 N~\ qubits to |0) <g> 
. . .(g>|0)(g>|l) (|1)). (1) Apply a Hadamard transform H to the first n qubits, so the first register 
reaches J2T=o l \ x ) I v2™. (2) Multiply the second register by f(x) = a x mod N (for some random 
a < N which has no common factors with N), to get \tp 2 ) = X^'lo 1 \ x )\^ x a x mod N) / \/2^ . 
Since the first register is in a superposition of 2 n terms \x), the modular exponentiation is 
computed for 2 n vàlues of x in paral·lel. (3) Perform the inverse QFT on the first register f22|1 , 
giving |-0 3 ) = Y?y=Q l Y?x=a e 2mxy ^ 2n \y)\a x mod N)/2 n , where interference causes only terms \y) 
with y = c2 n /r (for integer c) to have a substantial amplitude, with r the period of f(x). (4) 
Measure the qubits in the first register. On an ideal single quantum computer, the measurement 
outcome is c2 n /r for some c with high probability, and r can be quickly deduced from c2 n /r 
on a classical computer via continued fractions @. b. Detailed quantum circuit for the case 
N = 15 and a = 7. Control qubits are marked by •; © represents a not operation and 90 
and 45 represent z rotations over these angles. The gates shown in dotted lines can be removed 
by optimization and the gates shown in dashed lines can be replaced by simpler gates (see the 
methods section). 
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FIG. 2 Structure and properties of the quantum computer molecule, a perfluorobutadienyl iron 
complex with the inner two carbons 13 C-labeled. Based on the measured Ji3 C i9 F vàlues, we con- 
cluded that the placement of the iron is as shown, different than derived in Ref . [|Ï6H from infrared 
spectroscopy. The table gives the oJí/2-k at 11.7 T, relative to a reference frequency of ~ 470 
MHz and ~ 125 MHz for 19 F and 13 C respectively [Hz], the longitudinal (T lf inversion recovery) 
and transverse (T 2 , estimated from a single spin-echo sequence) relaxation time constants [s], 
and the J-couplings [Hz]. Ethyl (2- 13 C)bromoacetate (Cambridge Isotope Laboratories, Inc.) 
was converted to ethyl 2-fluoroacetate by heating with AgF followed by hydrolysis to sodium 
fluoroacetate using NaOH in MeOH. This salt was converted to 1,1,1,2-tetrafluoroethane us- 
ing MoF 6 and was subsequently treated with two equivalents of BuLi followed by l 2 to provide 
trifluoroiodoethene. Half of the ethene was converted to the zinc salt which was recombined 
with the remaining ethene and coupled using Pd(Ph 3 P) 4 to give (2,3- 13 C)hexafluorobutadiene. 
The end product was obtained by reacting this butadiene with the anion obtained from treating 
[(7r-C5H 5 )Fe(CO)2]2 with sodium amalgam [[1611 . The product was purified with column chro- 
matography, giving a total yield of about 5%. The sample at 0.88 ± 0.04 mole % in diethyl 
ether-dlO was dried using 3 À molecular sieves, filtered through a 0.45 /im syringe filter and 
flame sealed in the NMR sample tube using three freeze-thaw vacuum degassing cycles. All 
experiments were performed at 30°C. 
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FIG. 3 Pulse sequence for implementation of the quantum circuit of Fig. |T| for a = 7. The 
tall red lines represent 90° pulses selectively acting on one of the seven qubits (horizontal lines) 
about positive x (no cross), negative x (lower cross) and positive y (top cross). Note how 
single 90° pulses correspond to Hadamard gates and pairs of such pulses separated by delay 
times correspond to two-qubit gates. The smaller blue lines denote 180° selective pulses used for 
refocusing pï| , about positive (darker shade) and negative x (lighter shade). Rotations about z 



are denoted by smaller and thicker green rectangles and were implemented with frame-rotations. 
Time delays are not drawn to scale. The vertical dashed black lines visually separate the steps 
of the algorithm; step (0) shows one of the 36 temporal averaging sequences. 

FIG. 4 NMR spectra at different stages in the computation. a. Experimentally measured 
thermal equilibrium spectra (real part), acquired after a read-out pulse on spin i has tipped the 
spin from |0) (+z) or |1) (—-2) into the x — y-plane, where it induces a voltage oscillating at 
üJí/2tt + Y,j ±Jij/2 (where the sign depends on the state of the other spins) in a transverse 
RF coil placed nearby the sample. This voltage was recorded by a phase-sensitive detector and 
Fourier transformed to obtain a spectrum, with the phase set such that positive (negative) lines 
correspond to a spin in |0) (|1)) before the readout pulse. Freqüències are in Hertz, and with 
respect to ují/2tï. b. Experimental spectra for the effective pure ground state. As desired, only 
one line is retained in each multiplet with its position depending on strength and sign of the 
J-couplings. Here, the transition corresponds to all other spins in |0). The state p\ is obtained 
from this state by applying a not on spin 7. c. Output spectra of the easy case of Shor's 
algorithm (a = 11). The top traces are the ideally expected spectra, the middle traces are the 
experimental data, and the bottom traces are simulations which incorporate decoherence effects 
(vide infra). Each trace was rescaled separately. d. Similar set of spectra as in c, but for the 
difficult case (a = 7). 
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